* fix(security): harden auth and credential handling (HH-444) * fix(security): address HH-444 review blockers * fix(security): close remaining HH-444 review blockers --------- Co-authored-by: Rogee <rogee@ipao.vip>
49 lines
1.3 KiB
JavaScript
49 lines
1.3 KiB
JavaScript
import Auth from '../api/auth';
|
|
|
|
const parseErrorCode = error => Promise.reject(error);
|
|
const AUTH_HEADERS = ['access-token', 'token-type', 'client', 'expiry', 'uid'];
|
|
|
|
export default axios => {
|
|
const { apiHost = '' } = window.chatwootConfig || {};
|
|
const wootApi = axios.create({
|
|
baseURL: `${apiHost}/`,
|
|
withCredentials: true,
|
|
});
|
|
const authHeaders = {};
|
|
let refreshRequest;
|
|
|
|
wootApi.interceptors.request.use(config => {
|
|
Object.assign(config.headers, authHeaders);
|
|
return config;
|
|
});
|
|
wootApi.interceptors.response.use(
|
|
response => {
|
|
AUTH_HEADERS.forEach(header => {
|
|
if (response.headers?.[header])
|
|
authHeaders[header] = response.headers[header];
|
|
});
|
|
return response;
|
|
},
|
|
async error => {
|
|
const request = error.config;
|
|
if (
|
|
error.response?.status !== 401 ||
|
|
request?._retry ||
|
|
request?._sessionRefresh ||
|
|
!Auth.hasAuthCookie()
|
|
) {
|
|
return parseErrorCode(error);
|
|
}
|
|
request._retry = true;
|
|
refreshRequest ||= wootApi
|
|
.get('/auth/validate_token', { _sessionRefresh: true })
|
|
.finally(() => {
|
|
refreshRequest = null;
|
|
});
|
|
await refreshRequest;
|
|
return wootApi(request);
|
|
}
|
|
);
|
|
return wootApi;
|
|
};
|